package com.calvin.study.service.sys.security;

import javax.servlet.http.HttpServletRequest;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Service;

@Service("rbacService")
public class MyRBACService {

	public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
		Object principal = authentication.getPrincipal();
		if (principal instanceof UserDetails) {
			UserDetails userDetails = (UserDetails) principal;

			// 本次请求访问的资源
			// 因为userDetails.getAuthorities()继承了该接口GrantedAuthority，需要该接口的实现类来完成
			SimpleGrantedAuthority authority = new SimpleGrantedAuthority(request.getRequestURI());

			return userDetails.getAuthorities().contains(authority);

		}
		return false;
	}
	
}
